Nextjs signOut on a server action raised a cookies error in next-auth 5.0.0-beta.17

[peppescg]

Enviromnent

System:
OS: macOS 14.3.1
CPU: (10) arm64 Apple M3 Pro
Memory: 198.45 MB / 32.00 GB

Binaries:
Node: 20.11.0 - ~/.nvm/versions/node/v20.11.0/bin/node
npm: 10.2.4 - ~/.nvm/versions/node/v20.11.0/bin/npm
pnpm: 8.15.3 - ~/Library/pnpm/pnpm

Browser:
Chrome: 124.0.6367.62 

npmPackages:
next: 14.1.4 
next-auth: 5.0.0-beta.16
react:  18.2.0

I am trying to call the signOut based on API status code 401

'use server'
import { signOut } from '@/auth'
export async function handleUnauthorizedError(
  error: { status: number } | unknown
) {
  if ((error as { status: number }).status === UNAUTHORIZED_STATUS_CODE) {
    await signOut({ redirect: true, redirectTo: '/signin' })
  }
}

This raised a cookies error
Error: Cookies can only be modified in a Server Action or Route Handler. Read more: https://nextjs.org/docs/app/api-reference/functions/cookies#cookiessetname-value-options

My understanding was that it is possible to call signOut on the server, but it seems not working.

[SantiagoGaonaC]

Same error: Error: Cookies can only be modified in a Server Action or Route Handler. Read more: https://nextjs.org/docs/app/api-reference/functions/cookies#cookiessetname-value-options

[levinqdl]

You are seeing this error because you are invoking the server action directly in a server component render. You should pass the server action to action attribute of form element, or invoke it in an event handler or useEffect.

[levinqdl]

Can you describe your scenario and goals in detail? If you just want to ensure that the session exists and is valid, then when the conditions are not met, you only need to redirect to the login page, without calling signOut.

[peppescg]

My goal is to match every 401 status code from an API call server side, and call signOut.

As you can see above I explicitly call signOut in a server action, called from my API layer

[levinqdl]

I think it is sufficient to directly redirect to the login page because 401 means the session has expired. Also, I believe the use case for signOut is when the user actively logs out, which is not necessary in this scenario.

[peppescg]

I am not totally sure it is necessary to clean the cookies data. It is dangerous to clean manually, signOut is able to do that in a proper way.

and also 401 comes from API, and it could be also a business logic for a restricted page, without a session expired.

[peppescg]

@SantiagoGaonaC usually you need to define a separate file for instance actions defined it as a server action, creating a fn myAmazingSignout that contains signOut from next-auth and call it in your page.tsx

but I think you will reach the same error of mine